CVE-2026-73334

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

CVE-2026-73334

Apache Parquet (Java, org.apache.parquet.crypto.keytools package, versions 1.12–1.18 ) is vulnerable to unauthorized disclosure of KMS tokens when reading encrypted Parquet files. If the KMS URL is file-controlled rather than application-controlled, it is forwarded to a pluggable KmsClient implem...

EUVD-2026-74804

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery

Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...

CVE-2026-78377

URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-78377 Open Redirect in Yordam Informatics's Library Automation System

URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...

CVE-2026-78377

CVE-2026-78377 is an Open Redirect vulnerability in the Library Information and Document Automation Program by Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. The flaw allows URL redirection to an untrusted site, enabling phishing attacks. The af...

EUVD-2026-74783

URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...

CVE-2026-78377 Open Redirect in Yordam Informatics's Library Automation System

URL redirection to untrusted site 'open redirect' vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Phishing. This issue affects Library Information and Document Automation...

CVE-2026-87567

A flaw was found in Google Chrome. This user interface UI misrepresentation in URL formatting allows a remote attacker to leverage social engineering techniques. By using a specially crafted domain name, the attacker can spoof the address bar, potentially deceiving users about the authenticity of...

ALSA-2026:66204 Important: python-lxml security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RHEL 9 : python3.12-lxml (RHSA-2026:66203)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:66203 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

PT-2026-89206

Summary url fetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two write pdf channels ignore the document's url fetcher and build a fresh default URLFetcher instead. A restricti...

openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21778-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21778-1 advisory. This update for php-composer2 fixes the following issue: - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL bsc1278257. Tenabl...

RHEL 9 : python-lxml (RHSA-2026:66204)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:66204 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: wget (UTSA-2026-106779)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106779 advisory. GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allow...

ALSA-2026:66203 Important: python3.12-lxml security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...